147:4 Tian Tan,Yue Li,Xiaoxing Ma,Chang Xu,and Yannis Smaragdakis [c1,c2,...to model different run-time conditions.For example,for call-site sensitivity,c1 is the call site of m,and c2 is the call site of the method containing cl,etc.However,for efficiency, only the most recent I context elements are kept(I is also called the context length)and I is usually limited to a small number for whole-program analysis in practice [Kastrinis and Smaragdakis 2013;Smaragdakis et al.2011].There are three mainstream context-sensitivity variants for Java pointer analysis:call-site sensitivity,object sensitivity,and type sensitivity.Henceforth,we use 3obj to denote object sensitivity with context length being 3.Longer context indicates more precision:more spurious data flows can be possibly eliminated.Thus,3obj is more precise than 2obj.For different kinds of context elements with the same length,past work has demonstrated that object sensitivity typically outperforms call-site sensitivity,in terms of both precision and efficiency [Milanova et al.2005;Smaragdakis et al.2011],and is more precise but also more expensive than type sensitivity [Smaragdakis et al.2011;Tan et al.2017].Traditionally,context-sensitive pointer analysis uniformly applies context sensitivity to every method in a program to maintain high precision.However,this approach often does not work for large and complicated programs as such treatment is too costly to scale [Li et al.2018b;Smaragdakis et al.2014] Selective Context Sensitivity.Selective context sensitivity proposes to apply context sensitivity selectively,only for precision-useful/non-scalability-threat methods.The analysis precision of such methods will help improve the overall program analysis precision,while not incurring so much cost as to make the analysis hard to scale.The remaining methods are analyzed context-insensitively so that the space and time cost originally incurred for these methods(in traditional context sensitivity)is saved,leaving room to produce precise and scalable analyses even for hard-to-analyze programs.However,it is challenging to accurately determine which methods are precision-useful but not scalability-threat in general.To deal with this problem,in the past years,various selective context-sensitivity approaches have been presented,based on different insights and policies.For example,the target methods could be selected according to expert experience [WALA 2018]. program patterns [Li et al.2018a,2020],abstracted memory capacity [Li et al.2018b],parameterized heuristics [Hassanshahi et al.2017;Smaragdakis et al.2014],or machine learning approaches [Jeon et al.2018;Jeong et al.2017].In addition,in selective context sensitivity,some approaches apply the same context sensitivity to the selected methods [Hassanshahi et al.2017:Li et al.2018a.2020: Smaragdakis et al.2014],while in other approaches context elements and lengths may vary for different subsets of the selected methods [Jeon et al.2019;Jeong et al.2017;Li et al.2018b].We refer the readers to Section 7 for more details. 3 THE UNITY-RELAY FRAMEWORK,INFORMALLY We first give an overview of the Unity-Relay framework(Section 3.1),and then explain the key ideas of Unity (Section 3.2)and Relay(Section 3.3),respectively. 3.1 Overview Figure 1 shows a pictorial overview of the Unity-Relay framework:given a program P and a set of selective context-sensitive(C.S.)approach/strategy components,S,the framework will yield highly precise pointer analysis results for P. Unity-Relay is a one-two punch.It first calls its Unity component.Taking as input the results obtained by running each approach in S for P,the context-sensitivity selector of Unity(C.S.Selector in Figure 1)unifies them and makes new configuration about which portion of P should be analyzed by what context-sensitivity variants (ie.,what are the context elements and lengths)to maximize the precision,according to the unity principle,as introduced in Section 3.2.Intuitively,the Unity Proc.ACM Program.Lang.,Vol.5.No.OOPSLA,Article 147.Publication date:October 2021.147:4 Tian Tan, Yue Li, Xiaoxing Ma, Chang Xu, and Yannis Smaragdakis [c1,c2,...] to model different run-time conditions. For example, for call-site sensitivity, c1 is the call site of m, and c2 is the call site of the method containing c1, etc. However, for efficiency, only the most recent 𝑙 context elements are kept (𝑙 is also called the context length) and 𝑙 is usually limited to a small number for whole-program analysis in practice [Kastrinis and Smaragdakis 2013; Smaragdakis et al. 2011]. There are three mainstream context-sensitivity variants for Java pointer analysis: call-site sensitivity, object sensitivity, and type sensitivity. Henceforth, we use 3obj to denote object sensitivity with context length being 3. Longer context indicates more precision: more spurious data flows can be possibly eliminated. Thus, 3obj is more precise than 2obj. For different kinds of context elements with the same length, past work has demonstrated that object sensitivity typically outperforms call-site sensitivity, in terms of both precision and efficiency [Milanova et al. 2005; Smaragdakis et al. 2011], and is more precise but also more expensive than type sensitivity [Smaragdakis et al. 2011; Tan et al. 2017]. Traditionally, context-sensitive pointer analysis uniformly applies context sensitivity to every method in a program to maintain high precision. However, this approach often does not work for large and complicated programs as such treatment is too costly to scale [Li et al. 2018b; Smaragdakis et al. 2014]. Selective Context Sensitivity. Selective context sensitivity proposes to apply context sensitivity selectively, only for precision-useful/non-scalability-threat methods. The analysis precision of such methods will help improve the overall program analysis precision, while not incurring so much cost as to make the analysis hard to scale. The remaining methods are analyzed context-insensitively so that the space and time cost originally incurred for these methods (in traditional context sensitivity) is saved, leaving room to produce precise and scalable analyses even for hard-to-analyze programs. However, it is challenging to accurately determine which methods are precision-useful but not scalability-threat in general. To deal with this problem, in the past years, various selective context-sensitivity approaches have been presented, based on different insights and policies. For example, the target methods could be selected according to expert experience [WALA 2018], program patterns [Li et al. 2018a, 2020], abstracted memory capacity [Li et al. 2018b], parameterized heuristics [Hassanshahi et al. 2017; Smaragdakis et al. 2014], or machine learning approaches [Jeon et al. 2018; Jeong et al. 2017]. In addition, in selective context sensitivity, some approaches apply the same context sensitivity to the selected methods [Hassanshahi et al. 2017; Li et al. 2018a, 2020; Smaragdakis et al. 2014], while in other approaches context elements and lengths may vary for different subsets of the selected methods [Jeon et al. 2019; Jeong et al. 2017; Li et al. 2018b]. We refer the readers to Section 7 for more details. 3 THE UNITY-RELAY FRAMEWORK, INFORMALLY We first give an overview of the Unity-Relay framework (Section 3.1), and then explain the key ideas of Unity (Section 3.2) and Relay (Section 3.3), respectively. 3.1 Overview Figure 1 shows a pictorial overview of the Unity-Relay framework: given a program P and a set of selective context-sensitive (C.S.) approach/strategy components, 𝑆, the framework will yield highly precise pointer analysis results for P. Unity-Relay is a one-two punch. It first calls its Unity component. Taking as input the results obtained by running each approach in 𝑆 for P, the context-sensitivity selector of Unity (C.S. Selector in Figure 1) unifies them and makes new configuration about which portion of P should be analyzed by what context-sensitivity variants (i.e., what are the context elements and lengths) to maximize the precision, according to the unity principle, as introduced in Section 3.2. Intuitively, the Unity Proc. ACM Program. Lang., Vol. 5, No. OOPSLA, Article 147. Publication date: October 2021